Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Worm Threat Forces Apple To Disable Software?

Posted by Zonk on Fri Aug 03, 2007 12:15 PM
from the batten-down-the-hatches dept.
SkiifGeek writes "After the debacle that surrounded the announcement and non-disclosure of a worm that targets OS X, the vulnerability in mDNSResponder may have forced Apple to remove support for certain mDNSResponder capabilities with the recently released Security Update 2007-007. 'Seeming to closely follow the information disclosed by InfoSec Sellout, Apple's mDNSResponder update addresses a vulnerability that can be exploited by an attacker on the local network to gain a denial of service or arbitrary code execution condition. Apple goes on to identify that the vulnerability that they are addressing exists within the support for UPnP IGD... and that an attacker can exploit the vulnerability through simply sending a crafted network packet across the network. With the crafted network packet triggering a buffer overflow, it passes control of the vulnerable system to the attacker. Rather than patching the vulnerability and retaining the capability, Apple has completely disabled support for UPnP IGD (though there is no information about whether it is only a temporary disablement until vulnerabilities can be addressed).'"
+ -
story

Related Stories

[+] Worm Claimed For Apple OS X 398 comments
SkiifGeek writes "Controversy is slowly building over the development of a claimed new worm that targets OS X systems, dubbed by its inventor Rape.osx. Using a currently undisclosed vulnerability in mDNSResponder, the worm is said to give access to root as it spreads across the local network. As with a number of recent Apple-related security discoveries, the author, InfoSec Sellout, is delaying reporting the vulnerability to Apple until after completing full testing of the worm. While the worm has yet to leave a testing environment (with 1,500 OS X systems), it is bound to join the likes of Inqtana and Leap as known OS X malware."
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • by Anonymous Coward on Friday August 03 2007, @12:17PM (#20102701)
    Come here Apple fanboys-and-girls. Lunch is served.
    • by fermion (181285) on Friday August 03 2007, @03:58PM (#20106229) Homepage Journal
      This is what should happen. Fix it, or remove the feature, or at least make it optional. This is what Apple normally does. It does not ship with all ports open and sharing on.

      I hope this indicates a return to sensibility at Apple. Lately they are trying so hard to be like MS, that the security has suffered. Can't turn off HTML in email is at the top of my security vulnerabilities.

        • Re:wait a minute (Score:5, Insightful)

          by Sparks23 (412116) * on Friday August 03 2007, @03:58PM (#20106237)
          Realistically, no OS is completely secure. This is hardly the first security issue in OS X, nor will it be the last. Linux has had its share of security flaws, too.

          In the modern world, there are simply too many protocols and systems popping up; no operating system exists in a vacuum, and many vulnerabilities may be in services, subsystems and so on. And with the pressure to get things out and shave off extra CPU cycles, there are too many situations where someone simply goes 'oh, well, I checked that this data is valid up HERE, so I don't need to check again down here in this function I call later,' and then later another piece of code goes, 'oh, look, here is a function that does what I need, I will just reuse it' and assumes that function does its own error-checking, so does not check the data before passing into it. And thus, you create a pathway where unvalidated data gets passed down and can cause buffer overflows or whatever.

          No operating system or development team is somehow inherently immune to this.

          The thing is that Windows not only has kept large chunks of legacy code -- which makes it hard to really break down and restrict user permissions without breaking older programs -- but spent some time really pushing the Active X technology, which then proved to create a lot of problems. Apple, on the other hand, went off the tracks entirely and threw out their operating system; that was a risky move which could have killed them off entirely, but in the end they got an operating system which was built atop a multi-user system with better permissions.

          That does not mean that Apple somehow writes inherently better code than Microsoft; I happen to like OS X, but Apple's engineers are not necessarily smarter or more careful in the actual lines of code they write. The difference as I see it is that Microsoft is bogged down by hard-to-debug and support legacy code, while Apple got to make a cleaner start... and then on top of that, many bits of OS X (CUPS, zeroconf/Bonjour, WebKit, etc.) are open source.

          Apple contributes funds and engineering to these projects (and in some cases such as zeroconf, came up with the original specifications), but as they are open source things tend to get found and fixed faster in community review. That is why OS X, while not bulletproof, tends to be at least a bit more secure than Windows.

          That is my take on it, anyway.
  • News at 11... (Score:5, Insightful)

    by maztuhblastah (745586) on Friday August 03 2007, @12:20PM (#20102747)
    Researchers find hole, act like 1337 733ns about it. Company can't be sure that they've fixed hole, so they temporarily disable the reportedly-vulnerable function.

    Yawn.
      • Re: (Score:3, Insightful)

        Isn't it interesting that Slashdot threads that have anything to do with the adventures and histrionics of David Maynor instantly become peppered with a large number of idiotic, unsupported comments railing against Apple and "Apple FanBoiz," made by a variety of Slashdot accounts that rarely show up commenting on anything else?

        Here is a hint: A pretend army of supporters is still a pretend army.

        Isn't it fascinating to watch as shitty comments (like we see above), vacillate back and forth between "+5 Insight
      • Re:News at 11... (Score:5, Insightful)

        by gutter (27465) <ian.ragsdaleNO@SPAMgmail.com> on Friday August 03 2007, @01:59PM (#20104383) Homepage
        Hello, Artie McStrawman! Sure, there are a few idiots out there that believe that OS X is infallible - there are also some idiots out there that believe the same about windows or linux. However, you aren't likely to find them around here. You'll find plenty of people that believe that OS X is MORE secure than the some of the alternatives, largely because their heavy use of open source and their default configuration that ships with no open ports, but very few that think it is "inherently secure".

        The proof is in the number of successful worms and viruses for OS X, which depending on how you define them, hover right around zero. Yes, some of this is likely because of market share, but there's plenty of bragging rights associated with creating the first large-scale OS X compromise, so I wouldn't expect to see none. And of course, even if the relatively low number of security issues is because of market share, it doesn't make it any less pleasant for those of us who use OS X, especially since I'm not expecting it's share to go over 15-20%.

        Anyway, if I accept your statement that OS X isn't perfect, will you stop bitching about smug mac users every time there is a discussion marginally related to Apple?

        Thanks,
        gutter
          • Re:News at 11... (Score:5, Insightful)

            by sl3xd (111641) * on Friday August 03 2007, @05:39PM (#20107613) Journal
            Smugness is in the eye of the beholder; unfortunately, there's often nothing that can be done either way, as a great many people aren't able to accept that something other than their chosen product (or OS in this case) might have something that theirs doesn't.

            In other words, Ford Mustang owners tend to see Chevy Corvette owners as smug. Neither side is really willing to appreciate that each has advantages the other doesn't possess, and can't stand it when somebody highlights the advantage. That isn't ever going to change

            I don't see how the situation is any different when an operating system is concerned, rather than a brand of vehicle.

            Here's a news flash: OS X has advantages over Windows, Linux, and FreeBSD. OS X can brag about security, because there is a far smaller percentage of its users that have infected, compromised, or zombified machines. Ffind reasons to discount that fact is meaningless: It doesn't matter if the number of attackers is smaller; the goal is to not fall victim to an attack, which OS X has an excellent record of doing.

            Here's another one: Macintoshes have disadvantages: They don't have as much native software. A virtualization product like VMware or Parallels is a rare sight on Windows, yet is quite common on a Macintosh. There's always some app that only exists for Windows that the user can't live without. So Mac users not only pay $130 for OS X, but also $80 for a virtualization product, and then they have to buy the most expensive license for Windows. Mac software doesn't enjoy the "freedom" that most Linux users enjoy; much of the software for the Mac is closed-source.

            Still, you don't have to like it when OS X users dismiss the advantages of other OSes (like the amount of software for Windows, or the freeness of Linux).

            Just take the time to realize that's it's a different flavor of the time-honored "Chevy vs Ford" debate. What is "better" depends on the way the beholder sees things, and it's childish to believe that there's only one true way.
  • Um, so ? (Score:5, Insightful)

    by Space cowboy (13680) * on Friday August 03 2007, @12:22PM (#20102785) Journal
    Apple find a vulnerability (before the worm is announced, according to TFA), and remove that vulnerability in their next security update.

    I'm guessing there's a regular scheduled security update process in Apple. If you can't fix it in time for the next patch-release, isn't is *better* to temporarily disable it ? I really doubt it's a permanent removal of the feature - they're just being responsible.

    Simon.
  • ITS A LIE (Score:3, Funny)

    by Conor Turton (639827) on Friday August 03 2007, @12:23PM (#20102799)
    I'm sorry but the article must be a lie. The Apple fanboys assure me that there's no risk of vulnerabilities. Therefore, the article is wrong - it does not exist.
  • by zariok (470553) on Friday August 03 2007, @12:24PM (#20102815)
    So an "apple" is threatened by a "worm"... you don't say.

  • Hmmm... (Score:3, Interesting)

    by catdevnull (531283) on Friday August 03 2007, @12:24PM (#20102831)
    Isn't mDNSResponder and Open Source package ported for OS X?

      http://developer.apple.com/opensource/internet/bon jour.html [apple.com]

    Is Apple the developer of mDNSResponder or are they just using it?
  • by Night Goat (18437) on Friday August 03 2007, @12:26PM (#20102857) Homepage Journal
    Hey Zonk, how about using more reputable sources than one guy's blog for your links? I know they were picked by the submitter, but linking only to a blog and then putting a question mark after the headline is sketchy. I can't put much faith in the article if I can't be sure that it's not just a blogger talking out of his ass.
  • by Opportunist (166417) on Friday August 03 2007, @12:31PM (#20102945)
    I mean, it was a given that, given increasing market share, Apple becomes interesting for malware. No system is 100% secure.

    But at least they decided that it's better to disable the feature and minimize the damage to the net as a whole (and yes, even if you don't have an Apple, a worm damages you by clogging your tubes with packets trying to spread itself). MS decided that it's better to keep the insecure service up and running 'til it can be addressed.

    Question for 100: Still getting sober/blaster packets? I do.
  • by mcrbids (148650) on Friday August 03 2007, @12:32PM (#20102969) Journal
    Yes, I understand that there are certainly dissenting opinions here. But (IMHO) the thing that most Slash-bots complain about is that Microsoft will

    A) Pick a feature that's dumb. (like embed a scripting language into an image format, or give a spreadsheet scripting language access to the filesystem)

    B) Choose to preserve the dumb feature in spite of known security problems.

    C) Treat the resulting backlash as a "PR issue" rather than a technical one.

    D) Sometimes, if the backlash gets bad enough, they'll hack in security restrictions in response to specific known implementations that take advantage of the vulnerability rather than fix the vulnerability. EG: fixes that look for a XXX worm trace, rather than fix the thing that XXX worm exploits. (See anti-virus [wikipedia.org])

    Apple is doing the right thing, here, folks! It may or may not be that the feature mentioned is analogous to (A) above. Either way, Apple is chosing security over features, even though features are important.

    • Re: (Score:3, Interesting)

      Apple is doing the right thing, here, folks!
      Yes, because disabling support for the standard Internet Gateway Device support which software uses to seamlessly setup port forwarding on NAT systems etc. and having the user do it manually is good.

      Many, many programs use IGD, from Instant Messengers to games.

      Sorry, I cannot agree that it is the right thing.
  • by czmax (939486) on Friday August 03 2007, @12:40PM (#20103071)
    If you follow the link to the apple security update page there are actually two vulnerabilities associated with UPnP IGD. For one of them apple indicates that "this update addresses the issue by performing additional validation when processing UPnP protocol packets in iChat". For mDNSResponder apple indicates "this update addresses the issue by removing UPnP IGD support.

    Clearly something is unclear since iChat is obviously still using UPnP IGD, likely as a client?

    But why is the mDNSResponder using UPnP IGP anyway? mDNS is for service discovery etc and is basically a competitor to UPnP (I thought). Perhaps there is a way for mDNSResponder to leverage UPnP IGP to broadcast service messages (e.g. bonjour) across a local NAT? If so I've never seen nor heard of this working -- so perhaps what they're disabling is vulnerable code that wasn't doing anything anyway?

    • Re: (Score:3, Informative)

      Companies are generally considered to be plural entities in "real" English [grin]. I suppose we put a higher value on a collection of humans compared to a collection of metal parts...

      If you prefer, consider mentally replacing "Apple" with "the people who work at Apple"...

      Simon
    • by Rosyna (80334) on Friday August 03 2007, @12:39PM (#20103057) Homepage

      I'm not opposed to temporarily disabling functionality to fix something potentially disastorous.
      There are three options when implementing UPnP:

      1. Implement it to Microsoft's spec.
      2. Implement it correctly (by choosing a direction in places the spec contradicts itself or real implementations).
      3. Implement it securely.

      Choose only one.

      I do not think it is possible to implement UPnP securely and have it based on the spec. Also, the specific code they removed existed only for legacy NAT traversals and may not even be needed any more.
      • by frdmfghtr (603968) on Friday August 03 2007, @01:41PM (#20104037)

        I'm not opposed to temporarily disabling functionality to fix something potentially disastorous.

        There are three options when implementing UPnP:

        1. Implement it to Microsoft's spec.
        2. Implement it correctly (by choosing a direction in places the spec contradicts itself or real implementations).
        3. Implement it securely.

        Choose only one.

        I do not think it is possible to implement UPnP securely and have it based on the spec. Also, the specific code they removed existed only for legacy NAT traversals and may not even be needed any more.
        Is this the same UPnP capability that the FBI recommeded disabling [pcworld.com] in any Windows environment due to security issues quite some time ago?
        • by Rosyna (80334) on Friday August 03 2007, @03:26PM (#20105739) Homepage

          I call bullshit. You are saying it's not possible to implement UPnP without being vulnerable to a buffer overflow that may lead to remote code execution? Because that's one of the (at least) two issues at hand. Nice try on passing the responsibility for this bug to the spec writers (mentioning Microsoft seems to help too),
          Uhm, UPnP is a microsoft created and controlled spec, this is why I specifically mentioned Microsoft. Some people think it's not microsoft related because Microsoft hides their name from being easily found on the site (they do the same thing with the Zune). But, do a whois [networksolutions.com] on upnp.org or look at many of the UPnP documents [upnp.org] and you will see Microsoft's name plastered all over.

          Can you show me an implementation of UPnP that hasn't had bugs? According to wikipedia [wikipedia.org] security is a problem with the spec itself. It's getting so bad that some major router manufacturers are disabling the routing of UPnP packets by default on their non-consumer (and a few consumer) networking appliances.

          And my list was more of a dig at OOXML rather than being security related.
        • by node 3 (115640) on Friday August 03 2007, @05:11PM (#20107231)
          I'm just going to collect a few of your more inane tidbits together here:

          "Apple failed" (they did not)

          "OS X is every bit as crash prone and unreliable as Windows" (It's crash prone, but not "every bit as crash prone")

          "not so with Apple, which radically changes their OS every few years" (Two points here: 1. if this is true, it belies your following statement 2. it's not true)

          "There is no inherently superior security in OS X" (the overall design and implementation of OS X is more secure than the overall design and implementation of XP. Vista is a vast improvement over XP, but it remains to be seen how this works out)

          "those people who blame Microsoft for vendor lock-in" (straw man, no one claims this)

          "OS X is the ultimate in vendor lock-in" (OS X is an extremely open system. The only "lock-in" is with their hardware, which really isn't that big of a deal.)
          For someone who claims to be fighting against religious zeal, you sure come across fanatically angry. You make the basic fallacy that, "Windows is flawed, OS X is flawed, therefore Windows and OS X are equally flawed," which is complete nonsense.

          There are people who get fanatical about Macs, but you're lumping a whole lot of rational people in with them, and fully deserve flaimbait or troll modding for it.

          the minute you take a bite of the precious worm-ridden Apple, mods put you to sleep for a year
          No, stupid shit like, "eat crow" gets modded down. Eat crow for what? A security flaw existed? It was patched? WTF? A lot of anti-Apple sentiment gets modded up, as well, though generally the more rational stuff, like people complaining about vendor lock-in (like you did above) or various other things that actually make sense.

          Not to mention the fact that both you, and the OP are both (at present) modded positively, which makes your cries of being oppressed a bit silly.
    • by Tony Hoyle (11698) <tmh@nodomain.org> on Friday August 03 2007, @05:21PM (#20107393) Homepage
      mDNS - Apple
      UPNP - Microsoft

      Apple have disabled the Microsoft protocol. Won't affect them in the slightest I'd expect.

      mDNS is actually fairly useful.. you can advertise servers across the network using it, and it's an easy protocol to implement (a few hundred lines of code will do it).

      UPNP is an XML infested mess with a huge spec that I wouldn't try to implement unless I had a deathwish. And in all that mess they forgot to add any user or machine verification.. the upshot being if you enable it on a router you can disable its firewall with a 10 line perl script.